There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

National Institute of Standards and Technology における超伝導研究及び生活

The tight cost and implementation constraints of high-volume products, including secure RFID tags and smart cards, require specialized cryptographic implementations. The authors review recent developments in this area for symmetric and asymmetric ciphers, targeting embedded hardware and software. In this article, we present a selection of recently published lightweight-cryptography implementations and compare them to state-of-the-art results in their field.

/pdf/a-survey-of-lightweight-cryptography-implementations-2hbvlkwb1s.pdf

A Survey of Lightweight-Cryptography Implementations

BioMEMS/NEMS appliance biologically monitors an individual, using biosensors to detect cellular components. Data is simulated or analyzed using systems-biology software, which provides diagnostic or therapeutic guidance.

Integrated biosensor and simulation system for diagnosis and therapy

KeeLoq remote keyless entry systems are widely used for access control purposes such as garage openers or car door systems. We present the first successful differential power analysis attacks on numerous commercially available products employing KeeLoq code hopping. Our new techniques combine side-channel cryptanalysis with specific properties of the KeeLoq algorithm. They allow for efficiently revealing both the secret key of a remote transmitter and the manufacturer key stored in a receiver. As a result, a remote control can be cloned from only ten power traces, allowing for a practical key recovery in few minutes. After extracting the manufacturer key once, with similar techniques, we demonstrate how to recover the secret key of a remote control and replicate it from a distance, just by eavesdropping on at most two messages. This key-cloning without physical access to the device has serious real-world security implications, as the technically challenging part can be outsourced to specialists. Finally, we mount a denial of service attack on a KeeLoq access control system. All proposed attacks have been verified on several commercial KeeLoq products.

/pdf/on-the-power-of-power-analysis-in-the-real-world-a-complete-8sc7zakaj6.pdf

On the Power of Power Analysis in the Real World: A Complete Break of the KeeLoq Code Hopping Scheme

Cryptanalysis of symmetric and asymmetric ciphers is computationally extremely demanding Since the security parameters (in particular the key length) of almost all practical crypto algorithms are chosen such that attacks with conventional computers are computationally infeasible, the only promising way to tackle existing ciphers (assuming no mathematical breakthrough) is to build special-purpose hardware Dedicating those machines to the task of cryptanalysis holds the promise of a dramatically improved cost-performance ratio so that breaking of commercial ciphers comes within reach This contribution presents the design and realization of the COPACOBANA (Cost-Optimized Parallel Code Breaker) machine, which is optimized for running cryptanalytical algorithms and can be realized for less than US$ 10,000 It will be shown that, depending on the actual algorithm, the architecture can outperform conventional computers by several orders in magnitude COPACOBANA hosts 120 low-cost FP-GAs and is able to, eg, perform an exhaustive key search of the Data Encryption Standard (DES) in less than nine days on average As a real-world application, our architecture can be used to attack machine readable travel documents (ePass) COPACOBANA is intended, but not necessarily restricted to solving problems related to cryptanalysis The hardware architecture is suitable for computational problems which are parallelizable and have low communication requirements The hardware can be used, eg, to attack elliptic curve cryptosystems and to factor numbers Even though breaking full-size RSA (1024 bit or more) or elliptic curves (ECC with 160 bit or more) is out of reach with COPACOBANA, it can be used to analyze cryptosystems with a (deliberately chosen) small bitlength to provide reliable security estimates of RSA and ECC by extrapolation 1 

Breaking ciphers with COPACOBANA : A cost-optimized parallel-code breaker

Cryptanalysis of symmetric and asymmetric ciphers is computationally extremely demanding. Since the security parameters (in particular the key length) of almost all practical crypto algorithms are chosen such that attacks with conventional computers are computationally infeasible, the only promising way to tackle existing ciphers (assuming no mathematical breakthrough) is to build special-purpose hardware. Dedicating those machines to the task of cryptanalysis holds the promise of a dramatically improved cost-performance ratio so that breaking of commercial ciphers comes within reach.

This contribution presents the design and realization of the COPACOBANA (Cost-Optimized Parallel Code Breaker) machine, which is optimized for running cryptanalytical algorithms and can be realized for less than US$ 10,000. It will be shown that, depending on the actual algorithm, the architecture can outperform conventional computers by several orders in magnitude. COPACOBANA hosts 120 low-cost FPGAs and is able to, e.g., perform an exhaustive key search of the Data Encryption Standard (DES) in less than nine days on average. As a real-world application, our architecture can be used to attack machine readable travel documents (ePass). COPACOBANA is intended, but not necessarily restricted to solving problems related to cryptanalysis.

The hardware architecture is suitable for computational problems which are parallelizable and have low communication requirements. The hardware can be used, e.g., to attack elliptic curve cryptosystems and to factor numbers. Even though breaking full-size RSA (1024 bit or more) or elliptic curves (ECC with 160 bit or more) is out of reach with COPACOBANA, it can be used to analyze cryptosystems with a (deliberately chosen) small bitlength to provide reliable security estimates of RSA and ECC by extrapolation.

/pdf/breaking-ciphers-with-copacobana-a-cost-optimized-parallel-1fp8d5nfbe.pdf

Breaking ciphers with COPACOBANA –a cost-optimized parallel code breaker

In this paper we present new approaches to high performance protein database scanning on two novel massively parallel architectures to gain supercomputer power at low cost. The first architecture is built around a Beowulf PC-cluster linked by a high-speed network and fine-grained parallel Systola 1024 processor boards connected to each node. The second architecture is the Fuzion 150, a new parallel computer with a linear SIMD array of 1536 processing elements on a single chip. We present the design of a database scanning application based on the Smith-Waterman algorithm in order to derive efficient mappings onto these architectures. The implementations lead to significant runtime savings for large-scale database scanning. This result shows that both architectures provide high-throughput sequence similarity analysis solutions at a good price/performance ratio.

/pdf/massively-parallel-solutions-for-molecular-sequence-analysis-2li2mlcfxz.pdf

Massively parallel solutions for molecular sequence analysis

The computational fundament of most public-key cryptosystems is the modular multiplication. Improving the efficiency of the modular multiplication is directly associated with the efficiency of the whole cryptosystem. This paper presents an implementation and comparison of three recently proposed, highly efficient architectures for modular multiplication on FPGAs: interleaved modular multiplication and two variants of the Montgomery modular multiplication. This (first) hardware implementation of these designs shows their relative performance regarding area and speed. One of the main findings is that the interleaved multiplication has the least area time product of all investigated architectures. As a typical cryptographic application, we show that a 1024-bit RSA exponentiation can be performed in less than 6.1ms at a clock rate of 69MHz on a Xilinx Virtex FPGA.

Efficient hardware architectures for modular multiplication on FPGAs

A new modular multiplication algorithm and its corresponding architecture is presented. It is optimised with respect to hardware complexity and latency. Based on the dataflow of the well known interleaved modular multiplication the product of two n-bit-integers X and Y modulo M is computed by n iterations of a simple loop. The loop consists of one single carry save addition, a comparison of constant complexity, and a table lookup, where the table contains 6 precomputed values and two constants. By this construction the arithmetical complexity of the modular multiplication is reduced to n additions without carry propagation in total which leads to a speedup of at least two in comparison to all methods previously known. It consists of a first algorithm A2 implementing the new idea of combining carry save addition and constant time comparison. A2 is not optimal with respect to area and time. Its correctness is proven. By use of a small amount of precomputing the loop of A2 can be modified such that the effort within the loop is minimised. This leads to the algorithm A3 and it is verified.

Manfred Schimmler

Papers

Breaking ciphers with COPACOBANA : A cost-optimized parallel-code breaker

Breaking ciphers with COPACOBANA –a cost-optimized parallel code breaker

Massively parallel solutions for molecular sequence analysis

Efficient hardware architectures for modular multiplication on FPGAs

Area and time efficient modular multiplication of large integers